#!/usr/bin/env lua

luaiengine = require('luaiengine')

-- Example for analyse URIs and Host for detect Zeus Malware 

__author__ = "Luis Campo Giralte"
__copyright__ = "Copyright (C) 2013-2017 by Luis Campo Giralte"
__revision__ = "$Id$"
__version__ = "0.1"

function callback_uri(flow)
    print("Zeus activity detected on flow",str(flow))
end

function callback_host(flow)
    h = flow.http_info
    if (h) 
    then
        host = str(h.host_name)
        if (host) 
        then
            print("Suspicious activity detected on flow",str(flow),host)
        end
    end
end

st = luaiengine.StackLan()
pd = luaiengine.PacketDispatcher()
h_mng = luaiengine.DomainNameManager()

-- Parse the file and load the hosts and uris
for line in io.lines("zeus.dat") do 
    off = string.find(line,"/")
    if (off > 0) then
        host = string.sub(line,0,off - 1)
        uri = string.sub(line,off)

        h = luaiengine.DomainName(host,host)
        s = luaiengine.HTTPUriSet("Set for " .. host)

        h:set_callback("callback_host")
        s:set_callback("callback_uri")
        h:set_http_uri_set(s)

        s:add_uri(uri)
        h_mng:add_domain_name(h)
        -- print(host)
        -- print(uri)
    end
end

st:set_domain_name_manager(h_mng,"HTTPProtocol")

st.tcp_flows = 500000
st.udp_flows = 163840

pd:set_stack(st)
pd:open("enp0s25") 
pd:run()
pd:close()

h_mng:statistics()
print("bye")
